This thread was automatically locked due to age.
Do you use DPI Engine?
Because i guess, i figured out, what World of warcraft is doing.
Before the initial logging request is started, it seems to connect to a IPaddress.

After adding this IP to the local exclusion list, its working with the exceptions, you are using.
Looking into Central Firewall reporting, using Intercept X on the endpoint, you can see, this requests are caused by blizzard:

Category Games and web exceptions described in https://community.sophos.com/utm-firewall/f/web-protection-web-filtering-application-visibility-control/45070/master-list-of-web-exceptions/161552#161552
are set
FW rule from local lan src any to dest any any port is allowed outbound
Category Games and web exceptions described in https://community.sophos.com/utm-firewall/f/web-protection-web-filtering-application-visibility-control/45070/master-list-of-web-exceptions/161552#161552
are set
FW rule from local lan src any to dest any any port is allowed outbound